ASP.NET Core Web API Interview Question #58

What should an API validate in a JWT access token?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

The API should validate the token's cryptographic signature and the security properties required by its trust model. Common checks include the expected issuer, intended audience, expiration/lifetime, and signing key.

Detailed Explanation

Validation settings must match the identity system issuing the token. Disabling validation simply to make a token work can turn an authentication problem into a security vulnerability.

Code Example

options.TokenValidationParameters =
    new TokenValidationParameters
    {
        ValidateIssuerSigningKey = true,
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        ClockSkew = TimeSpan.FromMinutes(1)
    };